The ToolShed listed on sarcoma leak site

• Ransomware group: sarcoma
• Country: New Zealand
• Sector: Retail & E-Commerce
• Announcement date: April 4, 2025

The ToolShed, a retail company based in New Zealand, has been listed on a ransomware leak site by a threat actor group known as sarcoma. The announcement, which appeared on the group's platform, suggests that the organization has been targeted in a data breach operation.

The claimed attack event

According to the announcement made by the sarcoma group on April 4, 2025, the group claims to have obtained data belonging to The ToolShed. The group's listing coincided with the claimed date of the attack itself. While the group has made these claims publicly on their leak site, public information regarding the specific identity and operational history of the sarcoma group remains limited.

Ransomware groups often utilize leak sites as a component of a double extortion strategy. In such scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also exfiltrate sensitive data. The threat actors then threaten to release this stolen information on public forums if the ransom demand is not met. This tactic is designed to maximize pressure on the victim by leveraging the threat of reputational damage and regulatory scrutiny.

Details of the claimed data

The sarcoma group claims that the stolen data set consists of a 160 GB archive. Despite the significant size of the claimed archive, the group has not provided a detailed breakdown regarding the specific content of the leaked files. Furthermore, no screenshots or samples of the data have been provided to substantiate the claims made in the announcement.

• No specific data types were named in the listing.

When organizations face such threats, the lack of immediate clarity regarding the contents of a data breach can create significant uncertainty. Without a specific inventory of what was taken, it is difficult for the affected entity to determine the exact scope of the compromise or which specific individuals may be at risk.

About The ToolShed

The ToolShed is a New Zealand-based retailer that specializes in a variety of equipment and supplies. The company provides a wide range of products, including hand tools, power tools, automotive equipment, and various types of industrial machinery. Having operated for over 30 years, the organization serves a diverse customer base, ranging from professional tradespeople to individual users, by offering products from many well-known brands.

Potential impact and security implications

If the claims made by the sarcoma group are verified, the confidentiality of the organization's customer and employee data may be compromised. Such a breach could lead to significant consequences for the company. For instance, if the leaked data contains personal information, it could facilitate identity theft and targeted phishing attacks against the organization's customers. Furthermore, the organization may face operational disruptions and a negative impact on its commercial reputation.

From a regulatory perspective, the organization may face data breach notification obligations under New Zealand's Privacy Act 2020. This legal framework governs how personal information must be handled and requires organizations to take responsibility when such information is compromised. The motivation for the sarcoma group in this instance is assessed to be the pursuit of financial gain.

To defend against such threats, organizations in the retail and e-commerce sectors often implement various defensive measures. These include robust backup solutions to ensure operational continuity, multi-factor authentication to protect access to sensitive systems, and continuous monitoring to detect unauthorized data exfiltration. Additionally, maintaining a comprehensive incident response plan is a critical step for managing the fallout of a potential breach and meeting legal notification requirements.